00 · Overview

A hacker-history project about the phones that shaped phreaking culture and the ones you can still actually use in 2026.

Why this exists

The Motorola Razr and its ancestors aren't just nostalgia — they're the physical layer of an entire subculture. From Joybubbles whistling 2600 Hz in the 60s, to Wozniak and Jobs hand-building blue boxes, to the 2022 3G sunset that bricked a generation of feature phones, "the phone" has always been the hacker's first target and first toy.

The one-line thesis

Sections

• 01 — The phreak era: 2600 Hz, blue boxes, Cap'n Crunch, the birth of 2600 Magazine
• 02 — The network graveyard: US sunset timeline, what "works today" means
• 03 — Buying guide: dumb phones, flips, BlackBerry QWERTYs, Razr heirs
• 04 — Razr V3 deep dive: launch, design, sales, why it's bricked

★ Essentials: Why Old Phones in 2026

If you landed here without context: this museum exists for two overlapping audiences. People who love old phones (the Razr click, the Nokia ringtone, the sidekick's clacking QWERTY) and people who are trying to slip the surveillance state (no apps, no ad SDKs, no always-on microphone, no 47 background services calling home every 30 seconds). Both reasons lead to the same aisle of eBay.

The two honest answers to "Can I use an old phone today?"

1. If you want a device that makes calls on US carriers in 2026 — you need a phone with a 4G LTE radio + VoLTE on the right bands + carrier certification. The floor is roughly 2013–2014 hardware (Galaxy S5, iPhone 6, Kyocera DuraXE). Everything older is a brick in the US, though often still works in Europe, Mexico, and much of the world on 2G GSM.
2. If you just want to hold a Razr V3 and feel 2004 again — eBay has 10,000 of them for $20. It'll power on. It won't make calls on any US network. It's a sculptural object now, and that's fine.

The privacy/surveillance angle (what a "dumb phone" actually gets you)

What this museum covers (and where to start)

• New here? Start at 01 — Phreak History for the 2600 Hz story, then 02 — Network Graveyard for what killed old phones.
• Trying to buy a phone? Jump to 17 — Phone Finder for the full filterable list, or 12 — Purchase Guide for OPSEC considerations.
• Privacy-focused? See 04 — GPS Myth (the primer) and 06 — Privacy & Surveillance (the deep dive: IMSI catchers, SS7, baseband exploits).
• Restoring a vintage phone? 08 — Phone Anatomy & Restoration and 16 — Retro Projects.
• Looking at alternatives to phones entirely? 09 — Related Comms Tech — pagers, satellite, mesh networks, HAM.

The one-line thesis, restated

Old phones stopped working because the network moved, not because the hardware failed. A 2004 Razr V3 in a drawer is still mechanically perfect — it's just trying to shake hands with a tower that no longer speaks 2G GSM. Understanding what your phone can and cannot do in 2026 is mostly about understanding what the network speaks.

01 · Phreak History: 2600 Hz and the Blue Box Era

The frequency that started it all

Before "hacker" meant anything in computing, it meant phone phreak. The entire subculture hinged on a single tone: 2600 Hz.

AT&T's long-distance network in the 1960s was in-band signaled — the same copper pair that carried your voice also carried the control tones the switches used to route calls. When a trunk line was idle, the switch emitted a continuous 2600 Hz tone. When you hung up, your local exchange sent 2600 Hz upstream to say "caller is gone, release the line."

The exploit: if you played 2600 Hz into the handset mid-call, the long-distance switch thought you'd hung up — but your local exchange, which used different signaling, still considered the call active. The trunk was now "yours," and you could send multi-frequency (MF) tones to dial anywhere on the planet, toll-free.

Joybubbles (Joe Engressia)

Joseph Engressia — later legally renamed Joybubbles — was born blind with perfect pitch. As a child in the late 1950s he discovered he could whistle 2600 Hz into a phone and get free long distance. He is patient zero of phreaking. No tools. Just a mouth.

Captain Crunch and the cereal-box whistle

In 1963 the Cap'n Crunch cereal box shipped a plastic bosun's whistle as a prize. By pure coincidence, when you covered one of its two holes, it emitted an almost-perfect 2600 Hz tone. John Draper — later "Captain Crunch" — weaponized it. The whistle became the iconic artifact of the phreak era.

The blue box

Whistling was fragile. The next step was the blue box — a handheld tone generator that produced 2600 Hz plus the full MF signaling set (700, 900, 1100, 1300, 1500, 1700 Hz pair combinations) to dial any number on the trunk network. Early versions were built from Farfisa organs, doorbells, and cassette recorders. Later ones were custom PCB designs.

The Wozniak/Jobs connection

Steve Wozniak read Ron Rosenbaum's 1971 Esquire article "Secrets of the Little Blue Box" and went all-in. He designed a digital blue box using TTL logic — more reliable than the analog versions. Steve Jobs handled sales. They sold roughly 200 units door-to-door in Berkeley dorms at $150 each.

"If it hadn't been for the blue boxes, there would have been no Apple. I'm 100% sure of that." — Steve Jobs

The same two people who built Apple I first built a tool to commit federal toll fraud.

2600: The Hacker Quarterly

Founded in 1984 by Eric Corley (aka Emmanuel Goldstein), named directly after the tone. Still published today. The magazine turned phreak folklore into hacker canon and became the cultural bridge between analog phreaking and computer hacking.

Why phreaking died

Two reasons, both structural:

1. Out-of-band signaling (SS7). By the late 1980s the phone network moved call-control signaling off the voice path onto a completely separate digital network (Signaling System 7). You cannot whistle into SS7. The 2600 Hz exploit was gone.
2. Digital cell networks. Starting in the 1990s, wireless moved to GSM and CDMA with cryptographic authentication. The game shifted to SIM cloning, IMSI catchers, and SS7 attacks — a different, much harder sport.

Phreaking didn't lose. It evolved into every modern telecom security discipline.

02 · The Network Graveyard

The core problem

A phone is useless without a network that will talk to it. US carriers have systematically retired older radio protocols to reclaim spectrum for 4G LTE and 5G. If your phone only speaks a dead protocol, it is a brick — even if the battery still holds charge.

Sunset timeline (US)

What "still works" means in 2026

To register on a US network today a phone needs:

• 4G LTE radio on carrier-appropriate bands (Band 2, 4, 5, 12, 13, 17, 66 are the important ones)
• VoLTE (Voice over LTE) support — voice calls are now VoIP-over-LTE; LTE data alone isn't enough to make calls
• Ideally carrier certification / IMEI whitelist entry. Verizon in particular refuses to activate phones not on its approved list, even if the radio is technically compatible

Phones that used to work and now don't [BRICKED]

• Original Motorola Razr V3 (2G GSM)
• Motorola StarTAC (TDMA/AMPS)
• Nokia 3310 original, Nokia 5110, Nokia 6110 (2G GSM)
• BlackBerry Bold 9000, Curve, Pearl (2G/3G)
• iPhone 4 / 4S (3G only for voice)
• Sidekick (T-Mo 2G/3G)
• Nextel iDEN phones (iDEN shut down 2013)

Phones that still work [ALIVE]

• Nokia 2780 Flip — 4G LTE + VoLTE, all 3 major US carriers
• Light Phone II / III — LTE + VoLTE
• Sonim XP3plus — carrier-certified rugged LTE
• Unihertz Titan — Android LTE, universal bands, QWERTY
• iPhone 6s and up — LTE + VoLTE
• Samsung Galaxy S5 and up — LTE + VoLTE

The international escape hatch

If you absolutely must use a 2G/3G phone, much of Europe, Latin America, and parts of Southeast Asia still run 2G GSM (often for IoT/M2M). A Razr V3 will still make calls in, say, Germany or Mexico on a local SIM — just not at home. Some hobbyists also run private GSM base stations (Osmocom OpenBSC, YateBTS) in Faraday cages to light up vintage phones for display and museum use. That is legal only if the RF is fully contained.

03 · Motorola Razr V3: Deep Dive

The unveiling

Motorola CEO Edward Zander unveiled the Razr V3 at a press event in Chicago on July 27, 2004. It went on sale in Europe in September 2004 and in the United States in November 2004. Its internals were nothing special. Its exterior was the point.

Why it mattered

Industrial designer Chris Arnholt was responsible for the Razr's defining features:

• Aluminum-clad body, 14 mm thin — unheard of at the time for a flip phone
• Electroluminescent keypad milled from a single metal wafer (no separate keys — the entire surface was one chemically-etched nickel sheet lit from underneath)
• External glass screen embedded flush into the lid
• Internally-hinged antenna (goodbye, stubby rubber nub)
• Custom blue backlight that became visual shorthand for "this is the future"

The name "Razr" was coined by executive Geoffrey Frost, who also pushed the premium-fashion marketing strategy.

The sales curve

The V3 was the best-selling phone in the United States in 2005, 2006, and 2007, and remained best-selling until the latter half of 2008, when the iPhone 3G finally dethroned it.

The cultural artifact

Seen in the hands of David Beckham, Reese Witherspoon, Paris Hilton. Featured in The Devil Wears Prada, 24, countless 2005-era music videos. The sound of the hinge snapping shut became a cinematic shorthand for "this conversation is over." It's genuinely one of maybe five phones that ever achieved pure cultural icon status (iPhone, BlackBerry, Razr, Nokia 3310, Sidekick).

Why it's dead in 2026

The original V3 is a 2G GSM 850/900/1800/1900 MHz phone. No UMTS, no LTE, no VoLTE, no CDMA. Every US carrier has retired the protocols it speaks:

• AT&T 2G GSM: shut down January 1, 2017
• T-Mobile 2G GSM: shut down April 2, 2024

There is no software update path. The radio is the radio. A V3 in the US in 2026 will power on, display "No Service," and drain its battery doing nothing.

Where it still works

• Parts of Germany, France, Italy (2G GSM preserved for M2M/IoT until at least 2028 in some markets)
• Mexico (Telcel/Movistar still run 2G in many regions)
• Much of Africa and Southeast Asia
• Private GSM base stations inside RF-shielded enclosures (Osmocom / YateBTS hobby setups, legal only if contained)

Why it's still worth owning

04 · The GPS Myth: Why Your "Dumb Phone" Isn't As Dark As You Think

A very common reason people buy dumb phones is the belief that they're escaping tracking — "no GPS, no camera, no surveillance." That's mostly a myth. Here's why.

The law that changed everything: E911 Phase II

In October 1999, the Wireless Communications and Public Safety Act of 1999 ("the 9-1-1 Act") was signed into US law. It directed the FCC to require wireless carriers to deliver actual caller location to Public Safety Answering Points (PSAPs) when someone dialed 911 from a cell phone.

The FCC implemented this as Enhanced 911 (E911), rolled out in two phases:

• Phase I (1998): Carrier must deliver the callback number and the cell tower/sector the call originated from. Rough — accurate to maybe a square mile in rural areas.
• Phase II (2001 onward): Carrier must deliver the caller's latitude and longitude, accurate to 50–300 meters depending on technology, within 6 months of a PSAP request.

The FCC deadline: 95% of a carrier's in-service phones had to be "location capable" by December 31, 2005. Carriers who missed it were fined.

Two ways to be "location capable"

The FCC didn't mandate GPS specifically. It mandated the outcome (accurate lat/long). Carriers picked between two approaches:

1. Network-based location — triangulation from cell towers using time-of-arrival and signal-strength math. No change needed to the handset. Used heavily on older CDMA networks (early Verizon).
2. Handset-based location — put a GPS receiver inside the phone, let the phone self-locate, and send the fix over the cellular network. More accurate, especially indoors with A-GPS (Assisted GPS, which uses cell-tower data + downloaded satellite almanac to get a fix in seconds instead of minutes).

By the mid-2000s, handset-based won. It was cheaper, more accurate, and carriers didn't have to upgrade every tower. The result: essentially every cell phone sold in the US since roughly 2005 ships with a GPS chip, including feature phones, flip phones, and rugged burners.

So yes — your Nokia 2780 Flip has GPS

Pick any "dumb phone" from the buying guide above. Check the spec sheet. You will find GPS listed on almost all of them:

• Nokia 2780 Flip: GPS yes, plus Google Maps preinstalled via KaiOS
• HMD Barbie Phone: GPS yes (it's literally a re-skinned 2780)
• Sonim XP3plus: GPS + GLONASS, used specifically for field-worker location tracking
• Kyocera DuraXV/DuraXE: GPS + location services, Verizon push-to-talk uses it
• Light Phone II / III: GPS yes — turn-by-turn navigation is one of the few features they include
• Punkt MP02: GPS yes
• Unihertz Titan: full Android, full GPS, full everything

The handful of exceptions are old-stock 2G imports, gray-market European candybars, and a few niche Amish-market devices that intentionally strip GPS hardware. They're also the ones that won't register on US networks anyway.

What dumb phones actually give you

• No app surveillance — no Facebook SDK, no AdMob, no TikTok, no always-on microphones feeding ML models
• No notification dopamine loop — the real product
• Much smaller attack surface — fewer exploitable components, no browser in many cases
• Long battery life — days to weeks instead of hours
• Physical durability — no cracked screens, no glass sandwiches
• Cost — $50–$300 vs $1000+

What they don't give you: invisibility to your carrier, invisibility to law enforcement with a warrant, invisibility to IMSI catchers, or exemption from E911 location delivery. A burner phone in the traditional sense — bought for cash, tossed after one use — still works for identity obfuscation, but not location obfuscation while it's powered on.

And the camera question

Most modern feature phones do include a low-res camera (VGA to 5MP), because it costs pennies and enables MMS. If you want a camera-free phone specifically (for classified facilities, SCIFs, prison use, etc.), look at:

• Sonim XP3 Plus "No Camera" SKU — deliberately manufactured without the camera module for secure-facility use
• Kyocera DuraXE Epic Non-Camera version — same story, sold to government and industrial buyers
• Punkt MP02 — no camera at all, by design

These are the genuine camera-free options. A regular Nokia 2780 will have a camera. A regular Razr V3 had one too (the 2004 model shipped with a 0.3 MP camera — even then).

05 · The Oldest Cell Phone That Still Works

"Works" is the whole question. There are three honest answers, and they give wildly different dates. This section lays out all three tiers with the specific phones that qualify.

Tier 1 — Still works on a US carrier in 2026

Floor: roughly 2013–2014 hardware. The hard requirement is VoLTE (Voice over LTE), because US carriers no longer route voice through 2G/3G circuit-switched fallback. A phone can have perfect LTE data and still be useless for calls if it can't do VoLTE. These are the oldest phones that still cross that bar:

Everything older than this is bricked on US networks. The iPhone 5s (2013), Galaxy S3 (2012), every BlackBerry Bold and Classic, every pre-2013 Motorola — all of them power on, all of them are useless. The cutoff is sharp and unforgiving.

Tier 2 — Still works somewhere in the world

Floor: 1992. 2G GSM was launched commercially in July 1991 on Radiolinja in Finland, and 2G GSM networks remain live in 2026 in parts of Germany, France, Italy, Switzerland, Mexico, Ecuador, much of sub-Saharan Africa, Southeast Asia, Australia (until 2027 in some states), and island nations. Any GSM phone from 1992 onward will register on those networks with a local SIM.

Tier 3 — Technically powers on, but no network anywhere

Pure museum pieces. These phones used 1G analog (AMPS, NMT, TACS) or early digital protocols (iDEN, TDMA, original CDMA) that have been shut down globally. They power on, the screens light up, the hardware is perfect — but there is no base station on Earth that will talk to them in 2026.

The headline answer

Practical buying tips for vintage-phone hobbyists

• Batteries are the real problem, not the phones. NiCd and early Li-ion packs from the 90s are long dead. Most vintage Nokia batteries can be replaced with compatible modern cells (BL-5C, BL-4C, etc. are still manufactured).
• Quad-band GSM (850/900/1800/1900) is what you want. It works in both European (900/1800) and American (850/1900) markets — future-proofs you for whichever 2G network outlives the others.
• Check the frequency bands before buying. A Razr V3 sold in the US in 2005 is often 850/1900 only and won't work on European 900/1800 2G networks. The "V3" branding hides major regional differences.
• SIM card size. Phones pre-2010 use full-size SIMs. Modern carriers issue nano-SIMs. You'll need a nano→standard SIM adapter, cheap and widely available.
• Prepaid SIMs in 2G markets are the easiest way to test a vintage phone. Telcel (Mexico), Vodafone (Germany), Orange (France), Movistar (various). Walk into a shop, get a SIM for under $10, activate, call.
• Private GSM base stations (Osmocom, YateBTS, running on a HackRF or USRP) let you light up vintage phones inside a Faraday cage for display or testing. Legal in the US only if the RF is fully contained — no leaking, no unlicensed transmission into shared spectrum.

06 · Privacy & Surveillance Deep Dive

The GPS Myth (section 04) is the primer — this section is the encyclopedia. What your carrier knows about you, what your apps know, which attacks are realistic, and what actually changes when you swap a smartphone for a dumb phone. Written with intellectual honesty: no "this device makes you invisible" hype, no "they're watching your every thought" paranoia.

Three independent surveillance layers (confusingly conflated)

What your carrier knows (layer 1 detail)

• IMSI (International Mobile Subscriber Identity) — a 15-digit number identifying your SIM. Carrier binds it to your real identity at activation.
• IMEI (International Mobile Equipment Identity) — 15-digit number burned into the phone's baseband. Carrier logs this along with every tower registration — if you swap SIMs but keep the phone, the IMEI ties sessions together.
• MSISDN — your phone number.
• ICCID — 19–20 digit SIM serial.
• Tower registration log — every tower your phone talks to, with timestamp. Carriers retain this 12–18 months (sometimes much longer under CALEA archiving). This is the cell site location information (CSLI) that shows up in criminal cases.
• E911 position fix — lat/long accurate to 50–300 m, delivered to PSAP on any 911 call. Carriers also have this for non-emergency calls; law enforcement access varies by jurisdiction.
• Call detail records (CDRs) — who you called, who called you, duration, tower IDs at each end. Retained years. Historical subpoena-accessible.
• SMS content — retained by many carriers for days to weeks. Subpoena-accessible where logged.
• Roaming and cross-border data — your home carrier knows when you connect to foreign networks and shares that with the foreign carrier.

The radio-layer threats (layer 3 detail)

IMSI catcher / Stingray

A rogue cell tower. Transmits a stronger signal than the real towers around you, forces your phone to register, captures your IMSI, and often downgrades the call to unencrypted 2G. Used by US law enforcement (Harris StingRay, KingFish, Hailstorm). Now also used by foreign intelligence services and, via HackRF + YateBTS, by hobbyists and criminals. Cost of building one dropped from $50,000 (Harris) to ~$300 (HackRF) over ten years.

• Defense: SnoopSnitch (Android), AIMSICD, Cell Spy Catcher — detect some catchers. GrapheneOS has some hardening. VoLTE-only phones make downgrade attacks harder. Faraday bag when truly paranoid.

SS7 attacks

Signaling System 7 is the 1970s-designed backbone that routes calls and SMS between carriers. It has essentially no authentication between carriers. If you control any SS7 node (some tiny Cameroonian carrier, for example) you can query any phone on any other network: location lookups, call forwarding, SMS interception (which breaks SMS 2FA).

• Defense: Stop using SMS for 2FA (use a TOTP app or hardware key). Carriers have partially deployed "SS7 firewalls" post-2016 but coverage is spotty.

Baseband exploits

The baseband processor in every phone runs a closed-source proprietary RTOS (Qualcomm, MediaTek, Samsung Exynos). It has full access to the main CPU, microphone, GPS, and storage. Vulnerabilities in it — like the Broadcom wi-fi bug Project Zero found in 2017 or the Qualcomm bug CVE-2020-11261 — can give a remote attacker root over cellular signaling alone. You don't get to open an attachment to be compromised.

• Defense: keep phone OS patched. Old phones stop getting baseband patches; they're more vulnerable, not less.

Silent SMS / ping

A "Type 0" SMS that doesn't display to the user but forces the phone to respond, revealing its cell ID. Used by law enforcement to locate phones without opening a case or generating a dialed call.

WiFi/Bluetooth tracking

Even with cellular off, your phone's WiFi probes (looking for known networks) and Bluetooth LE beacons advertise a unique MAC. Retail stores, airports, and city infrastructure log these. MAC randomization (iOS 14+, Android 10+) helps but isn't universal.

What apps know (layer 2 detail)

• Precise GPS whenever you grant any app location. Often shared with ad SDKs.
• WiFi networks scanned (even without connecting) — location-correlatable via Skyhook / Google's WiFi-to-location DB.
• Bluetooth devices seen — derives social graph (whose phones are near yours?).
• Sensor data — accelerometer, gyro, barometer; can reveal activity, elevation, steps, even keyboard inputs from vibration side-channels.
• Microphone + camera — either explicitly (Meta, TikTok), or via permissions granted once and never revisited.
• Clipboard — TikTok famously read clipboard every few seconds until called out in iOS 14.
• Contact book + call log — asked for at install, uploaded wholesale. Your name is in everyone else's phone even if you don't have a phone.
• Photos metadata — EXIF includes GPS, timestamp, device model.

The practical privacy ladder (realistic)

Further reading

• EFF's Surveillance Self-Defense (ssd.eff.org)
• Matt Blaze — Signaling Vulnerabilities in Wiretapping Systems (2005, foundational)
• Karsten Nohl — 60 Minutes SS7 demo (2016)
• Mayday (Kashmir Hill, 2019) — Stingray journalism
• Citizen Lab reports on Pegasus, Predator, ENFER spyware

07 · Carrier Bands, SIM Types & Compatibility

A phone works only if (a) its radio supports the right frequency bands for your carrier, (b) it supports VoLTE (since all US voice is VoIP over LTE now), and (c) the carrier hasn't blocked its IMEI. This section is the reference you look at before buying any phone that doesn't explicitly say "certified on Verizon/AT&T/T-Mobile."

US LTE bands that matter

VoLTE — the actual gatekeeper

Since ~2022, all three major US carriers have shut down 2G and 3G voice. That means your phone can have perfect LTE data and still be unable to make a phone call. Voice now flows as VoIP over LTE (VoLTE) or 5G (VoNR). Phones need:

• VoLTE radio support — the chipset
• IMS (IP Multimedia Subsystem) firmware — the software stack
• Carrier whitelist — Verizon specifically refuses to activate phones not on its approved IMEI list, even if the VoLTE stack is technically compatible. AT&T and T-Mobile are more permissive.

SIM types in 2026

• eSIM privacy consideration: eSIM profiles are installed via QR code and tied to the phone's EID (eSIM ID). Re-provisioning requires carrier action — you can't simply move an eSIM between phones like a physical SIM. Loss of a phone with eSIM is slower to recover.
• Dual-SIM strategies (privacy): keep your "real-name" SIM + a prepaid cash-bought burner SIM in one phone. Use the second for accounts you don't want linked to your identity. Many unlocked phones support dual-SIM; iPhones support one physical + one eSIM in most markets.

Carrier certification reality

• Verizon — strictest. Maintains a whitelist. A compatible phone that's not on the list won't activate. verizon.com/byod has the check tool.
• AT&T — moderate. Publishes compatibility but generally allows unlisted IMEIs if bands + VoLTE check out.
• T-Mobile — most permissive. Unlocked phones with matching bands + VoLTE generally just work.
• MVNOs (Mint, Visible, Google Fi, Cricket, US Mobile, etc.) — inherit the underlying carrier's rules. Visible = Verizon, Mint = T-Mobile, Cricket = AT&T.

Unlocked vs carrier-locked (buying advice)

• Always prefer unlocked when possible. Locked phones are cheaper upfront but lock you to the selling carrier until formally unlocked.
• US law (CRAP Act, 2014) requires carriers to unlock phones after you finish paying them off. Unlocking takes 2–14 days. Prepaid phones have separate unlock rules (usually 1 year of service).
• Unlocking does not add bands. A Verizon-only Kyocera phone with B13 only will still be Verizon-only after unlocking.

08 · Phone Anatomy, Failure Modes & Restoration

You bought a vintage Razr V3 at a flea market. It won't power on. Can you fix it? Often yes. This section covers the common failure modes and restoration paths for phones from the 1990s through 2015-era smartphones.

The six things that kill an old phone

Restoration workflow (any 2000s–2010s phone)

1. Inspect externally. Look for corrosion in battery compartment, SIM slot, charge port. Check screen for cracks / burn-in.
2. Open the back. Pull battery (if user-replaceable). Check for bulging — if bulged, do not use. Dispose at a battery recycler.
3. Inspect the battery compartment contacts. Clean with IPA + toothpick.
4. Test with a known-good battery. eBay sellers often list working replacements for popular phones ($8–$15).
5. Charge for 2 hours before power-on. Some charge controllers need a minimum voltage before allowing boot.
6. If it boots: check IMEI (*#06#), check menu, check SIM detection. If a 2G/3G phone, note the IMEI and check it's not blacklisted at imeipro.info.
7. If it doesn't boot: try external-power mode (connect charger without battery). Many phones will show a charge icon if the main board is alive but the battery circuit is dead.
8. If nothing: teardown. iFixit.com has guides for most phones 2007+. Older phones: search YouTube for "[model] teardown."

Phones with replaceable batteries (nostalgia-restorer's list)

Any phone with a user-replaceable battery is dramatically more restorable. By generation:

• All pre-2013 phones — virtually all had removable backs. Samsung Galaxy S through S5, iPhone 4/4S (difficult but doable), every Nokia, every Motorola Razr, every BlackBerry.
• Exceptions (already sealed pre-2013): iPhone 5 (sealed 2012), HTC One M7 (sealed 2013).
• 2014+ rugged phones that kept removable batteries: Kyocera DuraXE / DuraXV series, Sonim XP-series, Samsung Galaxy Xcover, CAT S22 / S62.
• 2024+ new rugged flips with removable batteries: Sunbeam F1 Orchid, some TCL Flip models.

Spare parts sources

• iFixit (ifixit.com) — parts, tools, guides for common phones.
• RepairsUniverse — screens, digitizers, batteries, charging ports.
• eBay — the only realistic source for truly obscure parts (Razr V3 flex cables, Nokia 8810 battery).
• AliExpress — bulk cheap replacement batteries and ribbon cables; quality variable.
• ImprintIndustries / ParsonsFix — boutique retro-phone restoration shops.

The Razr V3 restoration specifics

• Battery: BR50 (OEM) or BR56 (higher capacity aftermarket). $8 on eBay.
• Hinge ribbon cable: notorious failure point. Repair kits available but require microsoldering.
• Internal LCD: OEM replacements getting rare. Complete motherboard+LCD assemblies sell for $30–$60.
• Charge port: mini-USB (original) or replaced-mod to micro-USB by hobbyists.
• Firmware: Original firmware is on an internal ROM. Can be reflashed via RSD Lite + a Motorola USB cable if you have a firmware file. (p2kman.forumfree.it archive.)

09 · Related Comms Tech — Alternatives to the Cell Phone

The phone isn't the only way to communicate, and sometimes it's the worst way if your goal is privacy, resilience, or reach. These are adjacent technologies that deserve space in any phreak-adjacent museum.

Pagers

Yes, still sold, still worth it in specific niches. Motorola, Unication, Apollo all make 2026-current pagers. Used by hospitals, nuclear plants, Secret Service, most US emergency services, Orthodox Jewish communities on Shabbat. One-way (receive only) or two-way. Frequency-dedicated (POCSAG, FLEX) on separate carrier infrastructure from cell. Privacy note: pager networks are unencrypted — anyone with an RTL-SDR and pdw software can read every page in range. Don't page sensitive info.

Walkie-talkies (FRS / GMRS / MURS)

Uses: road trips, convoys, camping, neighborhood mesh for emergencies, kids-away-from-parents radios. Completely outside the cell system — no IMSI, no carrier log, no tower registration.

Amateur radio (HAM)

Licensed service, much wider frequency privileges. Three US license classes (Technician, General, Extra). Voice, digital modes (Winlink, FT8, JS8Call), repeater networks. Privacy caveat: HAM operation is explicitly public — encryption is prohibited in most bands (you must identify by callsign every 10 minutes). It's a community tool, not a privacy tool. But it's unmatched for disaster resilience.

Satellite phones

• Iridium — 66-satellite LEO constellation, global coverage including poles. Iridium 9575 Extreme / GO exec, Iridium GO! hotspot. $1,000–$1,600 hardware + $50–$150/mo service.
• Thuraya — mid-latitude GEO coverage, cheaper than Iridium, no polar coverage.
• Inmarsat — enterprise/maritime.
• Globalstar — US/Americas focus; cheaper, less global.

Privacy: sat phone traffic still goes through a carrier and is legally interceptable. But the tower your phone is registering with is 600 km up and you're not in its cell log next to a known city.

Satellite messengers (SMS-style)

• Garmin inReach — Mini 2, Messenger, Explorer+. Uses Iridium. Two-way text + SOS. $15–$65/mo plans.
• Zoleo — similar, cheaper tiers.
• ACR Bivy Stick — same market.
• Apple Satellite Connectivity — built into iPhone 14+, SOS only (free for 2 years), US/CA/EU coverage via Globalstar.
• Android Satellite SOS — Pixel 9+ and some Samsung S24+, rolling out.

Meshtastic / LoRa mesh

Open-source peer-to-peer mesh messaging over LoRa (long-range low-power radio) at 915 MHz (US ISM band). Hardware: ~$40 LilyGo T-Beam or RAK Meshtastic node, optional paired phone app. Range: 2–8 km node-to-node, extending via mesh forwarding to tens of km in the right terrain. No carrier, no SIM, no cell tower, no account. Works during hurricanes, earthquakes, festivals, protests. Hobbyist / protest-adjacent community around it. The modern equivalent of phreak-era packet radio in spirit.

CBRS (Citizens Broadband Radio Service)

3.5 GHz band shared with US Navy radar. Enables private LTE/5G networks without carrier involvement. Used by enterprises, universities, industrial sites. Hobbyist deployment with Magma, Open5GS, srsRAN, YateBTS is possible but requires an SAS (Spectrum Access System) registration. Phreak-adjacent because it lets you run your own cell network.

Private GSM (ultra-phreak)

YateBTS, OpenBTS, OsmoBTS paired with a USRP / HackRF / BladeRF SDR lets you stand up a private GSM cell. Vintage 2G phones register with it. Legal in the US only inside a Faraday enclosure (not leaking to licensed spectrum). Primarily used for museum displays, vintage phone restoration testing, and academic research. The 2026 Faraday-phreak aesthetic.

Field phones / POTS (wired)

Landlines aren't dead. AT&T's copper landline network is being decommissioned (target: 2029 in most states) but VoIP-over-fiber landlines (Spectrum, Xfinity, CenturyLink) continue. A home with a landline can't be IMSI-caught, SS7-attacked, or cell-tracked. It's the most boring privacy win of all.

10 · SDR & Phreaking Hardware Reference

The hobbyist's radio-exploration kit. What's available, what it does, legal considerations.

Software-defined radios

Software stacks

• GNU Radio — the foundational open-source SDR toolkit. Graph-based signal flows.
• gqrx / CubicSDR / SDR++ — spectrum analyzer / waterfall GUIs for casual listening.
• YateBTS — GSM base-station stack. Stand up a private 2G cell.
• OpenBTS / OpenBSC / OsmoBSC — open-source GSM stacks, various flavors.
• srsRAN (srsLTE) — open LTE / 5G NR stack. Private LTE cells.
• Open5GS — 5G core network stack.
• Kismet — WiFi/Bluetooth/SDR sniffer.
• Wireshark — packet analyzer with GSMTAP support for GSM decoding.
• pdw — Paging Decoder Win, reads POCSAG pagers in real time.
• IMSI-Catcher detectors: SnoopSnitch (Android), cellmap.app, AIMSICD.

Hardware for the retro-phreak bench

• HackRF + Portapack H2 — HackRF in a portable case with a screen. Field kit for RF exploration.
• Flipper Zero — sub-GHz TX/RX, RFID, NFC, iButton, IR, BadUSB in a tamagotchi shell. Not for cellular, but complements the kit.
• Faraday bag / cage — required for legal private GSM operation. Mission Darkness, Silent Pocket, Defender Shield.
• Multimeter + soldering iron — the restoration-bench basics. Hakko FX888D, Fluke 87V, anti-static mat.
• USB JTAG / ISP programmer — for reflashing baseband / bootloaders on bricked phones. JTAGulator, RIFF Box, Octoplus.

Legal considerations (US)

• Receive-only is fine in all ISM/shared bands. Listening to public-safety, ham, FM, ADS-B is 100% legal.
• Receiving encrypted content without authorization is a 1986 ECPA violation. You can decode it locally for research, but publishing it is a different matter.
• Transmitting on licensed bands without a license is illegal FCC Part 15 / Part 95 / Part 97 depending on band. IMSI-catcher deployment against third parties is a federal crime regardless of jurisdiction.
• Faraday-caged private GSM for personal research is explicitly legal (the RF doesn't escape).
• Part 15 ISM experimentation (915 MHz LoRa, 2.4 GHz WiFi) is low-power open.

11 · Phone Brand Reliability & Privacy Tiers

Twenty-five years of data have sorted phone manufacturers into a stable hierarchy. Use this when buying vintage or modern dumb/rugged phones.

S-tier — build quality + privacy posture

• Punkt (Swiss) — MP02 dumb, MC02/MC03 privacy smartphone (AphyOS, no Google services). Philosophical privacy focus by design.
• Light Phone (US, NY) — Light Phone II/III. Custom LightOS. No apps, no browser, no social by architecture.
• Mudita (Poland) — Pure (dumb e-ink), Kompakt (e-ink smart-dumb). Focus-first minimalism.
• GrapheneOS-on-Pixel (Google hardware, de-googled OS) — technically highest-privacy smartphone. Not a brand but a stack.

A-tier — proven reliability

• Nokia (HMD Global) — still shipping feature phones (2660, 2780, 3210 revival, 6300, 8000). KaiOS or S30+. Built on decades of engineering.
• Sonim (US, rugged/industrial) — XP3plus, XP5plus, XP10. MIL-SPEC ratings. PTT-heavy. Used by utilities, FirstNet, field services.
• Kyocera (Japanese rugged) — DuraXE Epic, DuraXA Equip, DuraXV Extreme+. Rugged flips with AOSP Android underneath (tracking caveat).
• Motorola (Lenovo-owned) — legacy Razr brand, Moto G budget line. Razr 40 / Razr 2024 as modern foldable.
• Sunbeam (US) — F1 Horizon, F1 Pro. Amish/Plain community phones. Truly featureless by design. No browser, no apps, no camera options.

B-tier — functional mainstream

• Samsung — Galaxy S5 and up all VoLTE. Decent longevity on flagships. Bloatware-heavy.
• Apple — iPhone 6+ all VoLTE. Long OS support (7+ years). Privacy marketing is partly genuine (ATT, on-device ML) partly marketing.
• TCL / Alcatel — budget KaiOS flips (Flip 3, Flip 4 5G). Cheap, functional, limited ecosystem.
• HMD — separate from Nokia branding for newer projects (Barbie phone, Boring Phone).
• Unihertz — niche forms: Titan (QWERTY), Jelly Star (tiny), Atom (rugged mini). Full Android.

C-tier — caveats

• Orbic, Schok, Plum, AGM — budget Android flips/bars. Variable build, limited carrier cert.
• BlackBerry (BB Ltd licensee phones) — brand zombie. KEY2 etc. ran Android, support ended 2022.
• CAT (Caterpillar-branded) — rugged Android, OK but Bullitt Group (licensor) has been inconsistent.

D-tier — avoid

• Gray-market European candybars without US band support.
• Chinese no-name "mini" phones from eBay/AliExpress — often have hidden Android underneath with full tracking, missing US bands, no VoLTE.
• "Stealth / spy" phones from sketchy sites — usually rebadged budget Android with fake-secure marketing.

The two questions that matter when buying

1. Does it have the right US LTE bands + VoLTE + IMS? (If no — doorstop, regardless of brand.)
2. What OS is really underneath? Many "dumb" phones are stripped Android with the launcher hidden. That still means app SDKs, still means background services, still means tracking attack surface. The Kyocera DuraXE, for example, is Android inside. The Sonim XP3plus is Android. If this matters to you, verify before buying.

12 · Purchase Guide (with OPSEC)

Where to buy, and — if you care about OPSEC — how to buy.

Where to buy new

Where to buy used / vintage

• eBay — best selection of vintage; verify IMEI not blacklisted; check seller feedback.
• Swappa — used-phone marketplace with carrier/ESN verification built in.
• Facebook Marketplace / Craigslist — for cash deals; meet at a coffee shop.
• Estate sales — the best vintage phone pricing if you know what you're looking at.
• Goodwill / Savers — occasional finds at $3–$15.
• Reddit r/dumbphones, r/phreaking, r/retrophones — community sales.

OPSEC-conscious buying (the burner playbook)

If your reason for owning a dumb phone is privacy from layer-2 (apps), none of this matters — just buy normally. If you care about not being linked to the device at all, the steps matter:

1. Pay cash. At Walmart, Target, CVS, 7-Eleven, Best Buy. Don't use a rewards card, don't log a loyalty number.
2. Physical store, not online. Online purchase links your shipping address + payment method to the IMEI.
3. Activate prepaid with cash at the store or via prepaid refill card (also cash). TracFone, SafeLink, Net10, Simple Mobile, Boost prepaid, Cricket prepaid.
4. Use a new phone number — don't port an old one.
5. Don't link a real email. Use a ProtonMail or SimpleLogin alias for account recovery.
6. Activate and use from a different location than your home — the first tower the device registers with is logged.
7. Pair with Signal / Session / SimpleX — don't rely on carrier SMS.
8. Rotate — a "burner" you use for six months is not a burner. Plan a retirement cadence.
9. Dispose by destruction — SIM cut, phone smashed, both dropped in different trash bins in different cities. (Do not attempt to resell.)

Price anchors (2026)

13 · Glossary

14 · FAQ

Can I use a 2G phone in 2026?

Not in the US. AT&T 2G GSM shut down Jan 2017, T-Mobile 2G GSM shut down April 2024. Still works in parts of Europe, Mexico, much of Africa, Southeast Asia — 2G preserved there for M2M / IoT on refarmed bands, often till 2028 or later.

Can I use a 3G phone in 2026?

No US carrier runs 3G. All shut down by December 2022. Some international markets still have 3G UMTS.

What's the oldest iPhone that still works on US carriers?

iPhone 6 / 6 Plus (Sept 2014). First iPhone with full VoLTE on all major US carriers. iPhone 5s and earlier are bricked in the US.

Does a dumb phone really stop tracking?

It stops app tracking, not carrier tracking. Your carrier still logs your tower, still provides E911 location, still has call detail records. IMSI catchers still work against you. What you gain: no Facebook SDK, no TikTok clipboard read, no AdMob, no 47 background services.

Do modern dumb phones still have GPS?

Almost all of them do. E911 Phase II (2001+) essentially requires it. Nokia 2780, HMD Barbie, Light Phone, Punkt, Sonim, Kyocera — all have GPS chips. The exceptions are a handful of Amish-market phones (Sunbeam F1 family) and imported European 2G candybars that never got updated.

Can I buy a phone without a camera?

Yes, but the selection is small. Sonim XP3plus No-Camera SKU, Kyocera DuraXE No-Camera version, Punkt MP02, Mudita Pure, Easyfone Prime-A6, some Sunbeam F1 variants.

Is it legal to run a private GSM cell at home?

In the US: only inside a Faraday enclosure where the RF is fully contained. Transmitting on licensed GSM spectrum outside a cage without authorization is an FCC violation. A metal-mesh filing cabinet can work as a cheap cage.

What's VoLTE and why do I care?

Voice over LTE. Since the 2G/3G shutdowns, voice calls in the US are VoIP over 4G. Your phone needs both the LTE radio and the VoLTE/IMS firmware stack to make calls. Many older unlocked phones have LTE data but no VoLTE — they can browse but not call.

Will a European Nokia 3210 work in the US?

Probably not. The 2024 Nokia 3210 revival ships with European LTE bands (1/3/5/7/8/20/28) and is missing US bands 2, 4, 12, 13, 17. You'll get a "searching" screen and no signal. The vintage 1999 Nokia 3210 is 2G GSM and won't register on any US network.

What's the best truly camera-less privacy phone?

Punkt MP02 (no camera, no browser, LTE, by design) or Sonim XP3plus No-Camera SKU (rugged, FirstNet-friendly, no camera module). Both are genuinely without a camera, not just disabled.

Can I use my old phone as a WiFi-only device?

Yes — that's a common retirement path. Disable cellular, pull the SIM, use on WiFi for Spotify, Plex, ebook reading, as a kitchen clock or photo frame. Works on any phone with a usable battery.

What's the longest-lasting phone battery I can buy in 2026?

New: Sunbeam F1 Pro or Pro 2 — multi-day standby. Nokia 8000 4G / 225 / 110 — 18-day standby ratings. For Android: Sonim XP3plus, Unihertz Atom XL, CAT S62.

Can I still use my Razr V3 for anything?

As a cultural object, yes — it still snaps, still lights up. As a phone on a US network, no. As a phone on some European or Mexican networks, yes, on 2G GSM, for a few more years.

What's the difference between an unlocked and carrier-locked phone?

A locked phone only accepts SIMs from its original carrier. Unlocked accepts any carrier's SIM whose bands it supports. US law (CRAP Act 2014) requires carriers to unlock phones after you finish paying them off, typically 2–14 days after request.

Are there still any phones with physical QWERTY keyboards?

Yes: Unihertz Titan, Titan Slim, Titan Pocket (full Android + BlackBerry-style QWERTY), Minimal Phone (e-ink Android + QWERTY, 2024 crowdfunded). The BlackBerry brand proper (from BB Ltd.) is dead as of 2022.

What's the smallest smartphone I can buy?

Unihertz Jelly Star (3-inch screen, 2023) or Palm Phone (3.3-inch, 2018, now rare).

Are there privacy phones that aren't Android underneath?

Partially: Punkt MP02 runs a custom Punkt OS (not Android). Light Phone II/III run LightOS (Android base but all Google services stripped + no app install). Sunbeam F1 runs a custom non-Android OS. Mudita Pure/Kompakt run custom MuditaOS. All other "dumb phones" with apps (KaiOS, stripped Android) have an OS underneath that could theoretically host SDKs.

Can I detect an IMSI catcher around me?

Partially. SnoopSnitch (Android, requires root), AIMSICD, cellmap.app, Cell Spy Catcher report probable Stingrays based on tower behavior heuristics. False positives happen. No tool offers a guaranteed detection.

Does airplane mode stop tracking?

It stops your phone from registering with cell towers and (on most phones) turning off WiFi and Bluetooth. That stops cell tracking while it's on. The moment you turn it off, the phone registers again and the gap is visible in CSLI. A Faraday bag is more decisive.

15 · Modern Uses for Old Phones

Not every old phone should go to a landfill. Here's what your 2008 iPhone 3G, 2012 Galaxy S3, or 2004 Razr V3 can actually do today.

Privacy-focused

1. WiFi-only "dumb-smart" phone. Pull the SIM, disable cellular. Browse on WiFi only — home, cafes. No carrier tracking at all when cellular is off.
2. Dedicated Signal / SimpleX / Session device. One old phone, one secure-messaging app, nothing else installed. Never log into email or social.
3. Air-gapped password manager. Old phone, no network, run KeePassDX locally. Manual password entry from glance.
4. Disposable travel phone. Old phone, fresh prepaid SIM bought at the airport, factory-wipe before returning home.
5. Faraday-bagged backup. Old phone with essential info, kept in a Faraday bag for emergencies only.

Media / entertainment

6. Dedicated music player / Plex client. Old phone + wired headphones = the closest thing to an iPod in 2026.
7. E-reader. Old Android / iPhone with a reading app (KOReader, Libby, Kindle). Battery life on reading-only duty is days.
8. Dedicated video player. MX Player + sideloaded video files. No ads, no recommendations.
9. Ham-radio companion. RTL-SDR USB dongle + OTG cable + SDR Touch app.
10. Cassette-style portable stereo. Old iPod Touch + Bluetooth dongle + small portable speaker = beach box.

Home / practical

11. Dashcam. Mount on windshield, run AutoGuard or similar continuous-loop recorder. Cheaper than a dedicated cam.
12. Baby monitor. Pair with a modern phone via Alfred, Presence, or Manything.
13. Security camera. Same apps. Old phone taped to a window, pointed at the driveway.
14. Kitchen clock / timer. Permanently mounted on the fridge with a wall-clock face app.
15. Smart remote / universal remote. Old Android with IR blaster (HTC One, LG G2/3) = universal TV/AC remote.
16. Home-automation dashboard. Wall-mounted tablet running Home Assistant frontend.
17. Digital picture frame. Flipboard, SlideShow Pro, or Fotoo app. Fill with family photos.
18. Workshop music + timer. Dedicated garage/basement/shop phone — Spotify offline, weather, clock.

Work / education

19. Kids' first phone. Old phone, WiFi-only, with parent-installed apps only (Duolingo, offline games, photos).
20. Classroom / workshop demo device. Stripped phone that teachers loan to students.
21. Testing device for app developers. Old phones of various OS versions for compatibility testing.
22. Focus phone. Leave smartphone at home; carry dumb-phone-mode retired smartphone with only critical contacts.

Museum / display

23. Shelf piece. Some phones (Razr V3, Nokia 3310, Sidekick, iPhone original, StarTAC) are genuine industrial-design artifacts. Keep one, display under glass.
24. Faraday-caged private-GSM demo. Pair with HackRF + YateBTS to demonstrate pre-smartphone mobile tech for education.
25. Functional decoration. Mount a real vintage phone (wall phone, candlestick phone) as art.

16 · Retro & Privacy Projects

Weekend-to-multi-month projects that bring the phreak/privacy spirit into modern practice.

Weekend

1. Build a Faraday bag. Three layers of aluminum foil + a zip-lock sandwich bag. Tested with an RF meter or a call to a phone inside. Fun DIY before buying the real thing.
2. Run SnoopSnitch or cellmap.app around your city. Build a personal tower map, flag anomalies. One weekend of driving = a surprising amount of data.
3. Set up Signal + ProtonMail + SimpleLogin. Create the "minimum-footprint" comms triangle. Migrate your closest circle.
4. Wipe and repurpose an old phone as a dedicated Signal device (see section 15).
5. Buy an RTL-SDR and listen to POCSAG pagers. Eye-opening first exposure to RF privacy issues — every hospital page broadcast in clear text.
6. Start a phone collection shelf. Five iconic phones: Nokia 3310, Razr V3, BlackBerry Bold, Sidekick, iPhone original. All for under $200 on eBay.

Weeks

7. Restore a vintage phone. Razr V3, StarTAC, Nokia 8810 "Matrix phone" — replace battery, reflash firmware, test on a Faraday-caged GSM test cell.
8. GrapheneOS on a Pixel. De-google an Android. Keep smartphone utility without the Google surveillance layer.
9. Dual-SIM OPSEC routine. Set up a "real" identity SIM and a "burner" SIM in one phone. Use the burner for accounts you don't want linked.
10. Build a dumb-phone cradle for your smartphone. Physical container (jar, box, drawer) where the smartphone lives by default, forcing you to carry only the dumb phone.
11. Start a HAM license study. Technician exam in 2–4 weeks of casual study ($15 exam). Opens up legitimate RF experimentation.
12. Set up a Meshtastic node in your home and map your mesh reach. Week-long experiment in the neighborhood.

Months

13. Full private GSM lab. HackRF + YateBTS + Faraday cage (metal filing cabinet + copper mesh). Document on a blog.
14. Vintage phone collection with operability testing. 20+ phones, each checked on a test cell, each photographed and catalogued on a personal site.
15. Document a local scene's phone history. Oral-history project — older phreakers, ex-carrier engineers, retail sales reps at the 2G-sunset era. Publish as a zine or podcast.
16. Set up a community Meshtastic mesh. Recruit 8–15 neighbors / friends, map coverage, test emergency protocols.
17. Build a SIM-card museum. Every SIM size (standard → micro → nano → eSIM), every decade of carrier branding, framed.
18. Create a "minimal phone" ritual. One week/month dumb-phone-only as an ongoing habit, documented.
19. Launch a prepaid-burner subscription service. Actually reasonably viable small business — buy prepaid phones in bulk, curate OPSEC kits, sell to journalists and activists.
20. Run a "phone detox" weekend event. Community workshop: surrender smartphones, spend 48 hours on provided Nokia 2780s, debrief after.

Lifetime

21. Become a carrier / MVNO. CBRS band + small business license + 100 customers = real tiny phone company. Has been done solo.
22. Write a book on phreak history / phone privacy aimed at non-technical readers. Space exists for this in 2026.
23. Fund and maintain a preservation archive of phone hardware and firmware. Your own or contribute to TOSEC / Dumps / No-Intro.
24. Volunteer with the EFF / ACLU on cellular surveillance issues. Real policy work.
25. Teach a community class on cell phone privacy and OPSEC. Local library, hackerspace, or maker space.

17 · Phone Finder

Every phone from this project in one filterable database — year, form factor, capabilities, US-carrier status, app-tracking exposure, and whether it's genuinely alive, nostalgia-only, or a dead museum piece. Search, filter by feature, and click the checkbox on any phone to add it to your wishlist. Checked phones pin to the top and persist in your browser across reloads. Two views available: the original card layout, or the classical table view (Phone Finder 2.0).

Sources

• John Draper — Wikipedia
• Blue box — Wikipedia
• Phone Phreaks: the proto-hackers — Evervault
• Joybubbles — hackcur.io
• Cap'n Crunch Whistle — Telephone Museum
• FCC — Plan Ahead for Phase Out of 3G
• Carrier shutdown timeline — PhoneArena
• 3G network shutdown — Swappa
• Motorola Razr V3 — Wikipedia
• Razr V3: The iPhone of Yesteryear — TechSpot
• Flashback: Razr V3 — GSMArena
• Best Dumb Phones 2026 — Gizmochina
• Best Minimalist Phones 2026 — BGR
• Best dumbphone 2026 — Android Central
• Dumbphone Finder
• FCC — Enhanced 911 Wireless Services
• Enhanced 911 — Wikipedia
• Wireless E911 Location Accuracy Requirements — Federal Register
• HMD x Heineken "Boring Phone" — TechRadar
• HMD Barbie Phone Review — NextPit
• Kyocera DuraXA Equip
• Duoqin F22 Pro — /dev/knill
• Unihertz Jelly Star — official
• Minimal Phone — Indiegogo
• Light Phone III review — Slate
• Boox Palma 2 Pro as minimalist phone — Android Authority
• Orbic Journey V — official
• Best Phones for Kids 2026 — SafeWise
• History of the Sidekick — Complex
• Motorola StarTAC — Wikipedia
• Remembering 2000s Cell Phone Era — Rare Historical Photos
• Lively Jitterbug Flip2 — official
• Jitterbug Phone Reviews — The Senior List
• Dumbphones: The Complete Guide 2026 — Keyphone
• Best Dumbphones 2026 — Pause Gadget
• Dumbphones (4G era) compilation — Too Many Atoms
• Nokia 2720 Flip specs — GSMArena
• Tracfone Flip Phones — official
• Consumer Cellular IRIS Easy Flip — official
• AT&T Cingular Flip IV / Cricket Debut Flip — Phone Scoop
• Lively Jitterbug Flip2 — official
• Punkt MC02 5G Secure Phone — official
• Punkt MC03 Premium Secure Phone — official